Integration of application services into a network can be a difficult and costly undertaking, which is especially the case when the network devices are provided by different vendors. For example, an application control module may provide a high-performance network stack capable of terminating millions of TCP flows, as well as handling UDP and raw IP traffic. The Application Control Engine (ACE) module of CISCO SYSTEMS INC., San Jose, Calif. is one example application control module. However, the ACE module does not have a standard socket API for interacting with application services that operate on network data streams.
When an application service processes a packet, the service accepts data from an inbound connection, processes the data (i.e., performs a service) and forwards the data to an outbound connection. Existing socket APIs do not allow association between the inbound and outbound connections. There are, however, situations where association between the inbound and outbound connections may be desirable, such as when providing server load-balancing service (SLB) functions or providing L7 service functions (and particularly when the L7 service functions are chained).
For example, an SLB service may be run on top of an existing application control module, such as the ACE module discussed above, using the standard socket API. The standard socket API functions by terminating a connection from the client machine to a virtual IP (VIP) address of a server running the application control module and opening a new connection from a host IP address of the server running the application control module (other than the VIP) to a destination server. The load-balancing service then acts as a “man in the middle” by accepting data from the client machine, processing the data (i.e., performing an algorithm to select the best server to satisfy the client needs) and forwarding the data to the selected destination server. Using the standard socket API, two distinct connections exist, and the relationship between the connections is not maintained by the SLB service. In other words, the client communicates with the server running the application control module, and the server running the application control module communicates with the selected destination server.
Similarly, an L7 service may be run on top of an existing application control module using the standard socket API. When L7 services are chained, however, the input and output connections must be associated by the L7 services to ensure reliability of packet delivery and packet order. This may not be possible using the standard socket API because there may not be a one-to-one relationship between the packets sent to each L7 service and the packets received by each L7 service and each L7 service is free to open additional connections that are unrelated to a particular packet.